Software application integrity verification method and device

ABSTRACT

A method of verifying the integrity of a software application that can be executed on a host terminal includes (i) determining at least one series of control instructions forming an executable certificate for the software application, which can be executed by the host terminal during execution of the software application to be verified; (ii) on the host terminal, executing the software application to be verified, receiving the executable certificate determined during step (i) and executing the series of control instructions for the certificate which can be executed in the memory context of the host terminal; (iii) comparing the result thus obtained through execution of the control instructions with the result expected from an authentic software application; and (iv) in the event of a positive comparison, continuing with the execution of the software application to be verified.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application claims priority to and incorporates by referencePCT/FR03/03877 filed Dec. 23, 2003 and French Patent Application 0216652 filed Dec. 24, 2002.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

None.

THE NAMES OF THE PARTIES TO A JOINT RESEARCH AGREEMENT

None.

INCORPORATION-BY-REFERENCE OF MATERIAL SUBMITTED ON A COMPACT DISC

None.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to the verification of the authenticity ofa software application executed on a host terminal without necessarilyresorting to encoding/decoding keys.

2. Description of Related Art

It finds a general application in the authentication of softwareapplications and, more particularly, software applications intended tobe executed on a data processing apparatus, more especially a hostterminal such as a digital television decoder, equipment for visualisingmultimedia contents, a micro-computer, a smart card, a personalorganiser, a games console, a mobile telephone or the like.

Means of authentication are already known which permit the authenticityor the integrity of software applications loaded and executed on hostterminals to be verified. Generally such authentication means usecutting functions and/or cryptographic algorithms which use secret datasuch as private or secret encoding/decoding keys hidden in theverification software of the host terminal. Most often, these secretdata are protected by obfuscation techniques intended to makeretroconception more difficult.

In practice, such authentication means loaded in the host terminals arejust as vulnerable as the software applications, the authenticity ofwhich they are intended to control. In fact, an experienced pirate cancarry out malicious modifications to these authentication means inorder, for example, to recover the secret data, delude the verificationsystem or make it produce, in spite of itself, the expected results.

BRIEF SUMMARY OF THE INVENTION

The present invention overcomes this disadvantage. It relates to amethod of verifying the integrity of a software application which isexecutable in a host terminal.

According to a general definition of the invention, the method comprisesthe following steps:

i) determining at least one series of control instructions forming anexecutable certificate for said software application;

ii) on the host terminal, executing the software application to beverified, receiving the executable certificate thus determined duringstep i), and executing the series of control instructions for saidexecutable certificate in the memory context of said host terminal;iii) comparing the result thus obtained through the execution of thecontrol instructions with the result expected from an authenticapplication; andiv) in the event of a positive comparison, continuing the execution ofthe software application to be verified.

Understood here by the term “positive comparison” is the fact that anyaction, operation or modification on the data used by the softwareapplication to be verified or any action, operation or modification onthe running of the execution of the software application to be verifiedproduces a behaviour of the software application to be verifiedidentical to that which is expected by the running of the execution ofthe authentic application.

By renewing, at a selected rate, the series of control instructions forthe executable certificate, it is possible to carry out a large numberof authentication means for an application, and it becomes virtuallyimpossible to operate pirate software applications which systematicallyfoil the process of verification.

Thus, the method according to the invention permits the integrity of asoftware application executed on a host terminal to be verified with arelatively satisfactory degree of security in respect of pirates adeptat retroconception, and this without resorting to encoding/decoding keysor to expensive hardware components.

According to one embodiment, the series of control instructions isselected so that the state of the memory context of an authenticsoftware application after the execution of the series of controlinstructions is identical (without modification) to the state of thememory context of the software application prior to the execution of theseries of control instructions. Thus, the operation of the methodaccording to the invention does not cause any dysfunctioning at thelevel of the running of the software application to be verified if thelatter is authentic.

According to one embodiment, in which the host terminal is provided witha processor, the series of control instructions forming the executablecertificate is encoded in a language which can be interpreted by saidprocessor of the host terminal.

As a variant, in which the host terminal is provided with a virtualmachine which is capable of emulating a processor, the series of controlinstructions forming the executable certificate is encoded in a languagewhich can be interpreted by the virtual machine of the host terminal.

In practice, the memory context for executing a software application ismade up, inter alia, of the addresses in the memory of the symbols(functions, variables, . . . ), of the executable instructions, of thedata, and of the state of the execution stack of the application. Thesevalues are unique for each computer application in the course ofexecution and for each type of processor or virtual machine.

In step i), provision is made to establish, in a secure environment, amap with the memory context of the authentic software application duringthe course of execution, to determine, by using the values of thismemory map, a series of control instructions which form an executablecertificate.

In step ii), the routing device of the executable certificate for thehost terminal is housed in an electronic processing circuit which isphysically separated from the host terminal. Always in step ii), therecovery of the execution values of the memory context is effected byreading the values at the addresses of the various portions of memory ofthe host terminal. In these portions are housed the executableinstructions intrinsic to the application, the values of the variablesand the values of the references to the functions of the application tobe controlled.

In step iii), the result obtained by the execution of said series ofcontrol instructions is a signature for the application to be verified.This signature is calculated by said series of control instructionswhich uses the values of the memory context of the software applicationto be verified during the course of execution. Preferably, the softwareapplication comprises instructions which permit said series ofinstructions to be inserted and executed in its memory context bysubstituting at least one address for executing an instruction of saidsoftware application by at least the address of one instruction of theseries of control instructions which form the executable certificate.

According to another embodiment, the series of control instructionsforming the executable certificate is transported into a stream of datanecessary for the execution of the software application to be verified.To force the execution of the series of instructions for said executablecertificate, said useful data are previously protected by an encodingmethod. The decoding of these data is correctly effected by said seriesof control instructions for the executable certificate if theapplication to be verified is an authentic application. If the method ofencoding uses a key, the latter is produced by the control instructionswith values of the memory context of the software application to beverified, values which form the signature of the software application tobe verified. The operations to obtain the encoding key are encoded inthe series of instructions for the executable certificate.

As a variant, the protection method is without a key, the series ofoperations to produce the accessibility of the data is in the series ofcontrol instructions for the executable certificate. In practice, theprotection of the necessary data for the operation of the softwareapplication to be verified is undertaken in a secure environment beforethese data are transmitted. The method of protection, with or without akey, must be reversible.

According to yet another embodiment, in which the execution of thesoftware application resorts to a smart card or any other secure circuitto operate, the series of control instructions is housed in the smartcard (or the secure circuit) and sent to the software application to beverified, the software application being capable of recovering andexecuting said series of control instructions thus sent with the datawhich it needs to operate. In practice, access to data transmitted bythe smart card (or the secure circuit) must be necessary to the softwareapplication to be verified for this to behave in an identical manner toan authentic application.

According to another embodiment, following a negative verification ofthe integrity of the software application to be verified, the executablecertificate executes instructions which resort to functions belonging toanother application.

The present invention also relates to an apparatus for verifying theintegrity of a software application for accomplishing the methodaccording to the invention.

According to an important characteristic of the invention, theverification apparatus comprises processing means capable of determiningat least one series of control instructions forming the executablecertificate for the software application, which can be executed by saidhost terminal during the execution of the software application to beverified, and comparison means for comparing the result of the executionof the executable certificate on the behaviour of the softwareapplication to be verified with the result expected from the behaviourof an authentic application, and means of modifying the execution of thesoftware application to be verified as a function of the result of thecomparison.

According to one embodiment, the verification apparatus comprises asmart card or any other secure circuit which is capable of containing,on the one hand, the series of control instructions forming theexecutable certificate and, on the other hand, an application effectingthe verification test. The host terminal is provided with a smart cardreader (or with a means for communicating with the secure circuit), andthe means for executing the software application to be verified aredesigned to load and execute in its memory context the series ofinstructions forming the certificate. The verification application inthe smart card or the secure circuit is designed so as to modify thenormal running of the execution of the software application to beverified if the result of the execution of the series of controlinstructions is not transmitted, in conditions previously defined, tothe verification application in the smart card or the secure circuit, orif the result of the verification proves to be negative.

According to a variant, the apparatus is capable of determining aplurality of executable certificates which differ from one anotheraccording to a selected rate and/or condition. In practice, the hostterminal belongs to the group formed by data processing apparatuses,digital television decoders, equipment for visualising multimediacontents, micro-computers, smart cards, personal organisers, gameconsoles, mobile telephones or the like.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING

Other characteristics and advantages of the invention will appear in thelight of the detailed description hereinafter and the drawings, inwhich:

FIG. 1 is a schematic view illustrating the verification of a softwareapplication, the useful data of which contain the executablecertificate, according to the invention; and

FIG. 2 is a schematic view illustrating the verification of a softwareapplication using a smart card according to the invention.

DETAILED DESCRIPTION OF THE INVENTION

In practice, the terms “genuine” and “authentic” are used irrespectivelyhere for a software application.

Understood here by “executable certificate” is a series of controlinstructions executable in the memory context of a software applicationin the course of execution, and the execution of which produces effectssuch as the execution of a software application to be verified has abehaviour identical to that which is expected if the latter is genuine.

With reference to FIG. 1, the software application to be verified 1 isloaded into a host terminal. For example, the host terminal belongs tothe group formed by data processing apparatuses, digital televisiondecoders, equipment for visualising multimedia contents,micro-computers, smart cards, personal organisers, game consoles, mobiletelephones or the like.

In practice, the software application to be verified 1 processes 3previously protected data 2, that is to say not processable by theapplication to be verified when control instructions of the executablecertificate, which will be described in more detail hereinafter, havenot authenticated the application to be verified. One method of makingthese data non-accessible consists of encoding them. Any other method ofreversible protection is conceivable.

These protected data 2 contain 7 an executable certificate 4 including aseries of non-protected control instructions, which are executed 5 bythe application to be verified 1. In practice, the control instructionsfor the executable certificate 4 are coded in the language of theprocessor of the host terminal, still called machine language. As avariant, the instructions for the executable certificate 4 may also becoded in the language of a virtual machine, emulating the behaviour of aprocessor.

These control instructions for the executable certificate 4 in machinelanguage are binary structures previously determined prior to theirbeing transmitted to the software application to be verified.

The control instructions for the executable certificate 4 are selectedso that only an authentic software application can execute them toproduce a result identical to that which is expected. As will be seen inmore detail hereinafter, the absence of dysfunctioning of the authenticsoftware application is obtained by selecting a series of controlinstructions in such a manner that the state of the memory context ofone software application to be verified 1 after the execution of theseries of control instructions is identical to the state of the memorycontext of the software application prior to the execution of the seriesof control instructions.

The executable certificate 4 may also be inserted in the stream of datawhich the application 1 is capable of processing. The insertion ofexecutable certificates in a stream of data may correspond to the casewhere it is necessary to authenticate a protected multimedia streamprocessing application, accessible to the user on condition that thelatter has fulfilled obligations such as defined by the seller of thecontents. The source of the multimedia stream may be a transmissionpoint of a broadcasting network, the permanent memory of the hostterminal, or even a memory unit extractable from the host terminal.

The control instructions for the executable certificate 4 are selectedto calculate 6 a signature 8 of the application to be controlled 1, byusing 9 the memory context of the application to be controlled 1, in thecourse of execution. The use of the memory context by the controlinstructions is achieved by picking-up the values of certain symbols(variables, functions, executable instructions) of the application to beverified in the course of execution. The recovery of these valuesdepends, inter alia, on the memory model implemented in the processor ofthe host terminal.

In practice, the series of control instructions for the executablecertificate 4 produces 6 a signature 8 which depends 9 on the memorycontext of the software application to be verified 1, and uses thissignature to lift the protection 10 of the protected data 2. If thesoftware application is authentic, the data 2 are rendered accessibleand their processing 3 by the software application to be verified 1 willproduce a result identical to that of an authentic application.

In the event that the executable certificate 4 containing the controlinstructions is inserted in a stream of data, it is necessary to forcethe application to execute these instructions. The control instructionsare then programmed to decode a portion of the stream of data which theapplication to be verified has to process. This necessitates a priorprocessing of the stream of data by encoding before this stream isaccessed, for processing, by the application to be verified. Thedecoding algorithm may be implemented in the control instructions or beavailable in the form of a function implemented in the terminal, andcalled-up by the control instructions. The keys, if used by the decodingalgorithm, are calculated by the control instructions by usingpreviously defined values of the memory context of the application inthe course of execution.

With reference to FIG. 2, the software application to be verified 11interacts 12 with a secure circuit 13, of the smart card or similartype.

The smart card 13 transmits 19 an executable certificate 15 containingcontrol instructions which are loaded and executed 16 by the softwareapplication to be verified 11. Thus, for an application 11 necessitating12 a smart card 13 to operate, the control instructions 15 are stored inthe smart card 13 and sent to the application to be controlled 11 bymeans of the interactive link 12.

To operate, the application to be controlled 11 uses 21 data 20 which itrecovers by interaction 12 with the smart card 13. These data 20 contain22 the executable certificate 15. The control instructions for theexecutable certificate 15, when they are stored on the smart card 13,are loaded by the application to be controlled 11 in such a manner thatthe latter executes them 16 according to the principle explained withreference to FIG. 1.

A signature 18 of the software application to be verified is produced 17by the control instructions for the executable certificate by using 14the memory context of the software application to be controlled.

The control instructions for the executable certificate interact 19 withthe secure circuit 13 in such a manner that the signature 18 of thecontrolled application 11 is transmitted to another verificationapplication 24 housed on the smart card 13, considered here as a secureenvironment. The verification application 24 in the smart cardmaintains, for each type of processor and for each application to becontrolled, a table of correspondence between the executable controlinstructions 15 and the expected results.

This correspondence table permits the validity of the signaturecalculated by the executable certificate 15 to be verified 23. If theresult of the verification is negative, the verification applicationhoused in the smart card interacts 12 with the application to becontrolled in order to modify the operation of the latter. If theverification is positive, the smart card 13 produces the data 20 whichthe software application 11 needs in order to operate 21.

In one embodiment, the certificates housed in the smart card or thesecure circuit change according to a selected rate or condition.

1. A method of verifying the integrity of a software application whichis executable in a host terminal, comprising the steps of: i) using thememory context of the authentic software application during the courseof execution for determining at least one series of control instructionsforming an executable certificate for the software application, whichcan be executed by said host terminal during the execution of thesoftware application to be verified; ii) on the host terminal, executingthe software application to be verified, receiving the executablecertificate thus determined during step i), and executing the series ofcontrol instructions of said executable certificate using the memorycontext of the software application to be verified; iii) positivelycomparing the result thus obtained through the execution of the controlinstructions in the memory context of said host terminal with the resultexpected from an authentic software application; and iv) in the event ofa positive comparison, continuing with the execution of the softwareapplication to be verified (1, 11).
 2. The method according to claim 1,in which the host terminal is provided with a processor, wherein saidseries of control instructions forming the certificate being coded in alanguage which can be interpreted by said processor of the hostterminal.
 3. The method according to claim 1, in which the host terminalis provided with a virtual machine which is capable of emulating aprocessor, wherein said series of control instructions forming thecertificate being coded in a language which can be interpreted by thevirtual machine of the host terminal.
 4. The method according to claim1, in which the executable certificate includes a portion of theprocessing necessary for the satisfactory operation of the authenticapplication.
 5. The method according to claim 1, wherein step i)comprising the steps of, establishing in a secure environment, a mapwith the memory context of the authentic software application during thecourse of execution, and determining, from the values of this memorymap, the series of control instructions intended to form the executablecertificate.
 6. The method according to claim 1, wherein, in step ii),the executable certificate for the host terminal emanates from anelectronic processing circuit which is physically separated from thehost terminal.
 7. The method according to claim 1, wherein, in step ii),the recovery of the execution values of the memory context comprisingthe step of reading the values at the addresses of the various portionsof the memory of the host terminal, these portions containing theexecutable instructions and the data intrinsic to the application to beverified.
 8. The method according to claim 1, wherein in step iii), theresult obtained by the execution of said series of control instructionsproduces a signature for the application to be verified, said step iii)comprising the step of calculating this signature by said series ofcontrol instructions which uses the values of the memory context of thesoftware application to be verified during the course of execution ofthe application.
 9. The method according to claim 1, wherein thesoftware application comprises instructions which permit said series ofcontrol instructions to be loaded and executed in the memory context mapby substituting at least one address for executing an instruction ofsaid software application by at least one instruction address of theseries of instructions which form the certificate.
 10. The methodaccording to claim 1, wherein the series of control instructions isselected in such a manner that the state of the memory context of thesoftware application after the execution of the series of controlinstructions is identical to the state of the memory context of thesoftware application prior to the execution of the series of controlinstructions.
 11. The method according to claim 1, wherein the series ofinstructions forming the certificate is transported into a stream ofdata necessary for the execution of the software application to beverified.
 12. The method according to claim 1, wherein the softwareapplication to be verified is wholly or partially encoded, the correctdeciphering of the software application being achieved in the event ofintegrity of the software application to be verified.
 13. The methodaccording to claim 1, further comprising: after step i), a stepconsisting of inserting the executable certificate into a first streamof data and of processing, through encoding, a second stream of the datanecessary for the satisfactory operation of the software application tobe verified, prior to said second stream being obtained for processingthrough the software application to be verified.
 14. The methodaccording to claim 1, wherein the series of control instructions isselected in such a manner that the state of the memory context of thesoftware application after the execution of the series of controlinstructions is without any modification to the state of the memorycontext of the software application prior to the execution of the seriesof control instructions.
 15. An apparatus for verifying the integrity ofa software application which is intended to be executed in a hostterminal for accomplishing the method according to claim 1, comprising:processing means capable of determining at least one series of controlinstructions for the software application, which can be executed by saidhost terminal during the execution of the software application, andwhich forms an executable certificate of said software application,means for moving said executable certificate to the host terminal andexecuting means for executing the series of instructions forming thecertificate on said host terminal during the execution of said softwareapplication, comparison means for positively comparing the resultobtained through the execution of the control instructions with theresult expected from an authentic application, and means which arecapable, in the event of a positive comparison, of continuing with theexecution of the software application to be verified.
 16. The apparatusaccording to claim 15, further comprising a smart card or any othersecure circuit which is capable of containing the series of controlinstructions forming the certificate, the host terminal being providedwith a reader for reading a smart card or with a means for communicatingwith the secure circuit, and the means for executing the softwareapplication being provided in order to pick-up, in the smart card or inthe secure circuit, the series of instructions forming the certificateduring the execution of the software application to be verified.
 17. Theapparatus according to claim 15, wherein the host terminal comprisingmeans of returning, to the smart card or to the secure circuit, asignature produced by the series of control instructions, and the smartcard or the secure circuit additionally comprises a software applicationverifying means which is capable of validating or invalidating theauthenticity of the software application to be verified in dependence onthe result of the comparison between a signature produced by the seriesof control instructions and a value for the signature which is known andpreviously stored in the smart card or in the secure circuit.
 18. Theapparatus according to claim 17, wherein the smart card comprises meansfor modifying the operation of the software application to be verifiedin the event of a negative comparison.
 19. The apparatus according toclaim 17, wherein the smart card comprises means for modifying theoperation of the software application to be verified in the event of anon-transmission of the signature in conformity with predeterminedconditions.
 20. The apparatus according to claim 15, further comprisingmeans which are capable of preventing the operation of the softwareapplication in the host terminal in the event of a negative comparison.21. The apparatus according to claim 15, wherein the host terminalbelongs to the group formed by data processing apparatuses, digitaltelevision decoders, equipment for visualising multimedia contents,micro-computers, smart cards, personal organisers, game consoles, andmobile telephones.
 22. The apparatus according to claim 15, wherein theprocessing means comprising means for determining a plurality ofexecutable certificates which differ from one another according to aselected rate and/or condition.
 23. The apparatus according to claim 16,further comprising means which are capable of inserting the executablecertificate into a first stream of data and means for processing,through encoding, a second stream of the data necessary for thesatisfactory operation of the software application to be verified, priorto said second stream being obtained for processing through the softwareapplication to be verified.
 24. The apparatus according to claim 15,wherein the processing means comprises means for determining a pluralityof executable certificates which differ from one another according to aselected condition.